Data Transfer Size Limits — Chunked & Throttled Data Transfer to Evade DLP/Proxy Size-Threshold Detection

let ChunkStaging =
    // Signal 1: sequentially-numbered archive chunk files staged locally ahead of a throttled transfer
    DeviceFileEvents
    | where Timestamp > ago(1d)
    | where ActionType == "FileCreated"
    | where FileName matches regex @"(?i)\.(7z|zip|rar|tar|gz)\.[0-9]{2,3}$"
        or FileName matches regex @"(?i)\.part[0-9]{1,4}(\.rar)?$"
        or FileName matches regex @"(?i)\.r[0-9]{2}$"
    | summarize Timestamp = min(Timestamp), ChunkCount = count(), Files = make_set(FileName, 10)
        by DeviceName, AccountName = InitiatingProcessAccountName, InitiatingProcessFileName, TimeBucket = bin(Timestamp, 15m)
    | where ChunkCount >= 4
    | project Timestamp, User = AccountName, Host = DeviceName, ProcessName = InitiatingProcessFileName,
        Destination = "(local staging)", SessionCount = ChunkCount, TotalBytesSent = long(null),
        MaxBytesSent = long(null), NearestThresholdMB = int(null), Signal = "ChunkedArchiveStaging",
        RiskScore = 55, Detail = strcat("Files=", tostring(Files));
// Base aggregation: proxy/firewall sessions whose sent-bytes land just under a common DLP/proxy inspection ceiling (80-100% of a round MB threshold)
let SubThresholdSessions =
    CommonSecurityLog
    | where TimeGenerated > ago(1d)
    | where isnotempty(SentBytes) and SentBytes > 1048576
    | where not(ipv4_is_in_range(DestinationIP, "10.0.0.0/8"))
        and not(ipv4_is_in_range(DestinationIP, "172.16.0.0/12"))
        and not(ipv4_is_in_range(DestinationIP, "192.168.0.0/16"))
    | extend NearestThresholdMB = case(
        SentBytes between (8388608 .. 10485760), 10,
        SentBytes between (20971520 .. 26214400), 25,
        SentBytes between (41943040 .. 52428800), 50,
        SentBytes between (83886080 .. 104857600), 100,
        SentBytes between (209715200 .. 262144000), 250,
        0)
    | where NearestThresholdMB > 0
    | summarize TimeBucket = min(TimeGenerated), SessionCount = count(), TotalBytesSent = sum(SentBytes),
        MaxBytesSent = max(SentBytes), Host = any(SourceIP)
        by User = SourceUserName, Destination = DestinationHostName, NearestThresholdMB, bin(TimeGenerated, 1d);
// Signal 2: same user/destination pair repeatedly landing just under the same threshold across many sessions in a day
let SubThresholdBurst =
    SubThresholdSessions
    | where SessionCount >= 6
    | project Timestamp = TimeBucket, User, Host, ProcessName = "", Destination, SessionCount, TotalBytesSent,
        MaxBytesSent, NearestThresholdMB, Signal = "SubThresholdProxyBurst", RiskScore = 75,
        Detail = strcat("MaxBytesSent stayed below the ", NearestThresholdMB, "MB threshold across ", SessionCount, " sessions");
// Signal 3: the daily aggregate volume is large despite every individual session staying capped -- the "low and slow" tell
let HighVolumeLowAndSlow =
    SubThresholdSessions
    | where SessionCount >= 6 and TotalBytesSent > 524288000
    | project Timestamp = TimeBucket, User, Host, ProcessName = "", Destination, SessionCount, TotalBytesSent,
        MaxBytesSent, NearestThresholdMB, Signal = "HighVolumeLowAndSlowExfil", RiskScore = 92,
        Detail = strcat("TotalBytesSent=", TotalBytesSent, " over ", SessionCount, " sub-threshold sessions in 24h");
union ChunkStaging, SubThresholdBurst, HighVolumeLowAndSlow
| sort by RiskScore desc, Timestamp desc

index=proxy sourcetype="pan:traffic" bytes_sent>1048576 NOT dest_ip="10.0.0.0/8" NOT dest_ip="172.16.0.0/12" NOT dest_ip="192.168.0.0/16"
| eval NearestThresholdMB=case(
    bytes_sent>=8388608 AND bytes_sent<=10485760, 10,
    bytes_sent>=20971520 AND bytes_sent<=26214400, 25,
    bytes_sent>=41943040 AND bytes_sent<=52428800, 50,
    bytes_sent>=83886080 AND bytes_sent<=104857600, 100,
    bytes_sent>=209715200 AND bytes_sent<=262144000, 250,
    true(), 0)
| where NearestThresholdMB>0
| bin _time span=1d
| stats count AS SessionCount, sum(bytes_sent) AS TotalBytesSent, max(bytes_sent) AS MaxBytesSent BY src_user, dest, NearestThresholdMB, _time
| where SessionCount>=6
| eval Signal=if(TotalBytesSent>524288000, "HighVolumeLowAndSlowExfil", "SubThresholdProxyBurst")
| eval RiskScore=if(Signal=="HighVolumeLowAndSlowExfil", 92, 75)
| table _time src_user dest NearestThresholdMB SessionCount TotalBytesSent MaxBytesSent Signal RiskScore
| append
    [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      (TargetFilename="*.7z.0*" OR TargetFilename="*.zip.0*" OR TargetFilename="*.rar.0*" OR TargetFilename="*.part1*" OR TargetFilename="*.r00")
      | bin _time span=15m
      | stats count AS SessionCount, values(TargetFilename) AS Files BY host, User, Image, _time
      | where SessionCount>=4
      | eval Signal="ChunkedArchiveStaging", RiskScore=55, dest="(local staging)", src_user=User
      | table _time src_user dest Files SessionCount Signal RiskScore ]
| sort - RiskScore -_time

sequence by host.name, user.name with maxspan=1d
  [file where event.type == "creation" and
    (file.name : "*.7z.0*" or file.name : "*.zip.0*" or file.name : "*.rar.0*" or file.name : "*.part1*" or file.name : "*.r00")
  ]
  [network where event.type == "connection" and
    network.direction == "outbound" and
    destination.bytes >= 8388608 and destination.bytes <= 10485760
  ]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    sourceip AS SourceIP,
    username AS User,
    destinationip AS DestinationIP,
    "Bytes Sent" AS BytesSent,
    LOGSOURCETYPENAME(logsourceid) AS LogSourceType,
    'SubThresholdProxyBurst' AS ThreatType
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%proxy%' OR LOGSOURCETYPENAME(logsourceid) ILIKE '%firewall%'
  AND "Bytes Sent" > 1048576
  AND (
    ("Bytes Sent" BETWEEN 8388608 AND 10485760)
    OR ("Bytes Sent" BETWEEN 20971520 AND 26214400)
    OR ("Bytes Sent" BETWEEN 41943040 AND 52428800)
    OR ("Bytes Sent" BETWEEN 83886080 AND 104857600)
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory="network/proxy" OR _sourceCategory="network/firewall"
| where bytes_sent > 1048576
| where (bytes_sent >= 8388608 AND bytes_sent <= 10485760) OR (bytes_sent >= 20971520 AND bytes_sent <= 26214400) OR (bytes_sent >= 41943040 AND bytes_sent <= 52428800) OR (bytes_sent >= 83886080 AND bytes_sent <= 104857600)
| timeslice 1d
| count AS SessionCount, sum(bytes_sent) AS TotalBytesSent, max(bytes_sent) AS MaxBytesSent BY src_user, dest_host, _timeslice
| where SessionCount >= 6
| eval Signal = if(TotalBytesSent > 524288000, "HighVolumeLowAndSlowExfil", "SubThresholdProxyBurst")
| eval RiskScore = if(Signal = "HighVolumeLowAndSlowExfil", 92, 75)
| sort by RiskScore desc

rule chunked_size_limit_evasion_exfil {
  meta:
    author = "df00tech"
    description = "Detects repeated outbound sessions sized just under a common DLP/proxy inspection ceiling, indicating deliberate size-throttled exfiltration"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1030"
    reference = "https://attack.mitre.org/techniques/T1030/"

  events:
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.network.direction = "OUTBOUND"
    $net.network.sent_bytes >= 8388608
    $net.network.sent_bytes <= 10485760
    $net.principal.user.userid = $user
    $net.target.hostname = $dest

  match:
    $user, $dest over 1d

  condition:
    #net >= 6
}

#event_simpleName=NetworkConnectIP4
| BytesSent >= 8388608
| BytesSent <= 10485760
| RemoteIP != /^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)/
| Signal := "SubThresholdProxyBurst"
| groupBy([UserName, RemoteIP, ComputerName], function=[count(as=SessionCount), sum(field=BytesSent, as=TotalBytesSent), max(field=BytesSent, as=MaxBytesSent)])
| test(SessionCount >= 6)
| RiskScore := if(TotalBytesSent > 524288000, 92, 75)
| sort(field=RiskScore, order=desc)